Even as India’s cyber fraud cases surge, victims say they are being failed twice—first by scammers, then by their own banks. Despite clear Reserve Bank of India (RBI) directives ensuring “zero liability” for timely reporting, many customers recount a troubling pattern: delays, deflection, and a lack of urgency that allows money to vanish even after formal complaints are lodged.
At the Counter, as Money Vanished
When a journalist from Besant Nagar walked into her local bank branch earlier this month, she expected help, not heartbreak. Minutes earlier, she had been on a call with someone claiming to be her bank manager, “Anup Kumar,” who instructed her to download an app to resolve a technical issue with her account. The call, she later learned, was part of a sophisticated fraud.
Within hours, as she stood inside the bank describing the incident, two unauthorized withdrawals — ₹1 lakh and ₹99,999 — drained her savings. Even as she pleaded with the staff to act, the money continued to disappear in real time.
“The fraud happened right there, at the bank,” she recalled. “I was trying to draw the staff’s attention, but they were clueless. The manager just said, ‘The money is gone. I told you to change the number.’”
The irony was inescapable: a customer standing in the branch, alerting staff of a live fraud, yet helpless as the system moved too slowly to stop it.
When the System Turns Inward
Her case is not isolated. Across India, victims of online banking fraud have reported money being withdrawn even after they filed formal complaints. In many instances, bank officials advised victims to “change their registered mobile number” — a move that experts say often worsens the situation by cutting customers off from transaction alerts.
An engineering professor who lost ₹24,000 narrated a similar ordeal:
“I went straight to the bank and asked them to freeze my account. Instead of helping, they asked me to change my phone number. While I stood there, more money was debited.”
Such stories reveal a deeper procedural malaise. Despite RBI’s 2017 zero liability circular — which mandates full reimbursement if customers report fraud within three working days — banks often defer responsibility, citing procedural delays or “third-party breaches.” Clause 9 of the same directive requires banks to make a “shadow reversal” of the defrauded amount within ten working days. Yet, victims say these safeguards rarely reach them in time.
The Missing Accountability
Advocates and cybersecurity officials argue that the problem lies as much in institutional indifference as in ignorance.
“Banks would do well to circulate the 2017 RBI directives to customers,” said Sanjay Pinto, a Chennai-based advocate. “Instead, they’re busy spamming them with loan offers and KYC reminders.”
A senior officer from the Cyber Crime Wing was more blunt:
“In some cases, bank staff deliberately bypass procedures, telling victims to go to the police. By the time a formal complaint is filed, the fraudsters have vanished. In others, the staff simply don’t know the process.”
While most banks can freeze a victim’s account, few have mechanisms to block or trace the suspect’s account in real time — a gap that allows criminals to move funds through layered transactions before law enforcement can intervene.
Between Policy and Practice
RBI’s framework is clear: if a customer notifies the bank promptly, liability shifts away from the victim. But implementation falters at the branch level, where procedural rigidity and a lack of cybersecurity training often leave frontline employees ill-equipped to act decisively.
Cybercrime officials say timely reporting remains the only realistic defense. “We can retrieve lost amounts quickly only if the victim complains in time,” the officer noted. Yet, in both the Besant Nagar and professor’s cases, the victims were present at the bank itself — and still watched their savings slip away.
